Context-aware compromise assessment

Abstract

Assessing compromises of data security is achieved by establishing access control policies for data files in storage devices across an enterprise. A list is compiled of the data files that were accessed by processes executing on processors of the enterprise. A suspicion score is assigned to each of the processes based on deviations of in-memory behaviors of the processes from established criteria. In response to the suspicion score meeting a suspicious process criterion, the file system operations performed by the suspicious process are analyzed against the access control policies and the suspicion score is modified based on a degree to which the file system operations performed by the suspicious process violate the access control policies.

What is claimed is: 
     
       1. A method for assessing compromises of data security, the method comprising:
 establishing access control policies for data files stored in storage devices across a communication network of an enterprise: 
 monitoring processes executing on respective processors of the enterprise for file system operations performed thereby: 
 assigning a suspicion score to each of the processes based on a degree to which in-memory behavior of the process deviates from previously established criteria; 
 analyzing, in response to the suspicion score assigned to any of the processes meeting a suspicious process criterion, file system operations performed by the suspicious process against the access control policies; 
 modifying the suspicion score based on a degree to which the file system operations performed by the suspicious process violate the access control policies; 
 monitoring each process executing on each processor for data transport operations performed thereby in addition to the monitoring of the file system operations; 
 storing attributes of each of the file system operations and each of the data transport operations in respective graph node data structures; 
 identifying one or more correlations, each of the one or more correlations correlating one or more of the file system operations with one or more of the data transport operations for a given one of the processes; 
 storing attributes of the one or more correlations in graph edge data structures; 
 generating a process-network-file (PNF) graph data structure in which the graph node data structures representing the file system operations and the data transport operations are logically connected one to another through corresponding graph edge data structures representing the one or more correlations; and 
 rendering a representation of the PNF graph data structure on a display such that graphical representations of the graph node data structures are graphically linked by graphical representations of the graph edge data structures; 
 wherein the attributes of a given one of the one or more correlations stored in the graph edge data structures include a weight indicating the given correlation, and rendering the representation of the PNF graph data structure includes indicating the weight in the graphical representation of the graph edge data structures for the given correlation; 
 wherein the PNF graph data structure comprises, for the given correlation:
 at least one source node corresponding to one or more of the graph node data structures, the source node representing at least one of a source file and a source network connection for the given process; 
 at least one destination node corresponding to one or more of the graph node data structures, the destination node representing at least one of a destination file and a destination network connection for the given process; 
 at least one operator node corresponding to one or more of the graph node data structures, the operator node representing at least one of the given process and a user associated with the given process; and 
 at least one edge node corresponding to one or more of the graph edge data structures, the edge node representing relationships between the at least one source node, the at least one destination node and the at least one operator node; and 
 
 wherein the at least one edge node depicts the weight, which is an indication of a level of suspicious behavior associated with at least one of one or more of the file system operations and one or more of the data transport operations represented by the source node, the destination node and the operator node. 
 
     
     
       2. The method of  claim 1 , wherein the access control policies include specifications of business-sensitive content contained in the data files, and analyzing the file system operations comprises analyzing the content of the data files accessed through the file system operations against the specifications of the business-sensitive content. 
     
     
       3. The method of  claim 1 , further comprising:
 storing identifiers of the data files in an access list for each of the processes executing on each of the processors: and 
 purging the stored identifiers in accordance with a predetermined moving time window. 
 
     
     
       4. The method of  claim 1 , wherein at least one of the file system operations comprises at least one of a read and a write directed to one or more of the data files stored in one or more of the storage devices. 
     
     
       5. The method of  claim 1 , wherein at least one of the data transport operations comprises at least one of sending and receiving one or more of the data files over at least one network. 
     
     
       6. The method of  claim 1 , wherein the at least one source node comprises a file node representing the source file, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the file node to determine from where the source file was copied or transformed by the given process. 
     
     
       7. The method of  claim 1 , wherein the at least one destination node comprises a file node representing the destination file, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the file node to determine how the destination file was created. 
     
     
       8. The method of  claim 1 , wherein the at least one source node comprises a network node representing the source network connection, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the network node to determine whether malicious content was downloaded to a destination address identified in the source node. 
     
     
       9. The method of  claim 1 , wherein the at least one destination node comprises a network node representing the destination network connection, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the network node to determine whether the given process uploaded sensitive content. 
     
     
       10. The method of  claim 1 , wherein a given one of the access control policies comprises one or more regular expressions identifying at least one of one or more categories of data and one or more terms that correspond to business-sensitive content in the data files. 
     
     
       11. The method of  claim 1 , wherein a given one of the access control policies comprises one or more identities of designated portions of a file hierarchy, one or more user permissions and descriptive data of what is considered business-sensitive content in the data files. 
     
     
       12. An apparatus for assessing compromises of data security, the method apparatus comprising:
 a data security system configured to:
 establish access control policies for data files stored in storage devices across a communication network of an enterprise; 
 compile a list of the data files accessed by processes executing on processors of the enterprise; and 
 assign a suspicion score to each of the processes based on a degree to which in-memory behaviors of the respective processes deviate from previously established criteria; and a context-aware compromise assessment processor (CACAP) configured to: 
 analyze, in response to the suspicion score assigned to any of the processes meeting a suspicious process criterion, file system operations performed by the suspicious process against the access control policies; and 
 modify the suspicion score based on a degree to which the file system operations performed by the suspicious process violate the access control policies; 
 
 wherein the data security system monitors each of the processes executing on the processors for data transport operations performed thereby in addition to the monitoring of the file system operations, and the CACAP is further configured to:
 store attributes of each of the file system operations and each of the data transport operations in respective graph node data structures; 
 identify one or more correlations, each of the one or more correlations correlating one or more of the file system operations with one or more of the data transport operations for a given one of the processes; 
 store attributes of the one or more correlations in graph edge data structures; 
 generate a process-network-file (PNF) graph data structure in which the graph node data structures representing the file system operations and the data transport operations are logically connected one to another through corresponding graph edge data structures representing the one or more correlations; and 
 
 further comprising a display on which to render a representation of the PNF graph data structure such that graphical representations of the graph node data structures are graphically linked by graphical representations of the graph edge data structures; 
 wherein the CACAP is further configured to:
 store attributes of a given one of the one or more correlations in the graph edge data structures to include a weight indicating the given correlation; and 
 render the representation of the PNF graph data structure to indicate the weight in the graphical representation of the graph edge data structure for the given correlation; 
 
 wherein the PNF graph data structure comprises, for the given correlation:
 at least one source node corresponding to one or more of the graph node data structures, the source node representing at least one of a source file and a source network connection for the given process; 
 at least one destination node corresponding to one or more of the graph node data structures, the destination node representing at least one of a destination file and a destination network connection for the given process; 
 at least one operator node corresponding to one or more of the graph node data structures, the operator node representing at least one of the given process and a user associated with the given process; and 
 at least one edge node corresponding to one or more of the graph edge data structures, the edge node representing relationships between the at least one source node, the at least one destination node and the at least one operator node; and 
 
 wherein the at least one edge node depicts the weight, which is an indication of a level of suspicious behavior associated with at least one of one or more of the file system operations and one or more of the data transport operations represented by the source node, the destination node and the operator node. 
 
     
     
       13. The apparatus of  claim 12 , wherein the access control policies include specifications of business-sensitive content contained in the data files, and the CACAP analyzes the content of the data files accessed through the file system operations against the specifications of the business-sensitive content. 
     
     
       14. The apparatus of  claim 12 , wherein the data security system purges the list in accordance with a predetermined moving time window. 
     
     
       15. The apparatus of  claim 12 , wherein the data security system comprises a compromise assessment system and a data leakage prevention system. 
     
     
       16. The apparatus of  claim 12 , wherein:
 at least one of the file system operations comprises at least one of a read and a write directed to one or more of the data files stored in one or more of the storage devices; and 
 at least one of the data transport operations comprises at least one of sending and receiving one or more of the data files over at least one network. 
 
     
     
       17. A tangible, non-transient computer-readable medium having processor instructions encoded thereon that, when executed by one or more processors, configure the one or more processors to:
 enforce access control policies for data files stored on storage devices across a communication network of an enterprise; 
 compile a list of the data files accessed by processes executing on processors of the enterprise; 
 assign a suspicion score to each of the processes based on a degree to which in-memory behavior of the process deviates from previously established criteria; 
 analyze, in response to the suspicion score assigned to any of the processes meeting a suspicious process criterion, file system operations performed by the suspicious process against the access control policies; 
 modify the suspicion score based on a degree to which the file system operations performed by the suspicious process violate the access control policies; 
 monitor each process executing on each processor for data transport operations performed thereby in addition to the monitoring of the file system operations; 
 store attributes of each of the file system operations and each of the data transport operations in respective graph node data structures; 
 identify one or more correlations, each of the one or more correlations correlating one or more of the file system operations with one or more of the data transport operations for a given one of the processes; 
 store attributes of the one or more correlations in graph edge data structures; 
 generate a process-network-file (PNF) graph data structure in which the graph node data structures representing the file system operations and the data transport operations are logically connected one to another through corresponding graph edge data structures representing the one or more correlations; and 
 render a representation of the PNF graph data structure on a display such that graphical representations of the graph node data structures are graphically linked by graphical representations of the graph edge data structures; 
 wherein the attributes of a given one of the one or more correlations stored in the graph edge data structures include a weight indicating the given correlation, and the processor instructions include those that configure the one or more processors to render the representation of the PNF graph data structure to include an indication of the weight in the graphical representation of the graph edge data structure for the given correlation; 
 wherein the PNF graph data structure comprises, for the given correlation:
 at least one source node corresponding to one or more of the graph node data structures, the source node representing at least one of a source file and a source network connection for the given process; 
 at least one destination node corresponding to one or more of the graph node data structures, the destination node representing at least one of a destination file and a destination network connection for the given process; 
 at least one operator node corresponding to one or more of the graph node data structures, the operator node representing at least one of the given process and a user associated with the given process; and 
 at least one edge node corresponding to one or more of the graph edge data structures, the edge node representing relationships between the at least one source node, the at least one destination node and the at least one operator node; and 
 
 wherein the at least one edge node depicts the weight, which is an indication of a level of suspicious behavior associated with at least one of one or more file system operations and one or more data transport operations represented by the source node, the destination node and the operator node. 
 
     
     
       18. The computer-readable medium of  claim 17 , wherein the access control policies include specifications of business-sensitive content contained in the data files, and the processor instructions include those that configure the one or more processors to:
 analyze the file system operations comprises analyzing the content of the data files accessed through the file system operations against the specifications of the business sensitive content. 
 
     
     
       19. The computer-readable medium of  claim 17 , wherein the processor instructions include those that configure the one or more processors to:
 store identifiers of the data files in an access list for each of the processes executing on each of the processors; and 
 purge the stored identifiers in accordance with a predetermined moving time window. 
 
     
     
       20. The computer-readable medium of  claim 17 , wherein:
 at least one of the file system operations comprises at least one of a read and a write directed to one or more of the data files stored in one or more of the storage devices; and 
 at least one of the data transport operations comprises at least one of sending and receiving one or more of the data files over at least one network.